<p>
  Dynamically loaded classes could contain malicious code executed by a static class initializer.
  I.E. you wouldn't even have to instantiate or explicitly invoke methods on such classes to be vulnerable to an attack.
</p>

<p>This rule raises an issue for each use of dynamic class loading.</p>

<h2>Noncompliant Code Example</h2>
<pre>
String className = System.getProperty("messageClassName");
Class clazz = Class.forName(className);  // Noncompliant
</pre>

<h2>See</h2>
<ul>
  <li><a href="http://cwe.mitre.org/data/definitions/545.html">MITRE, CWE-545</a> - Use of Dynamic Class Loading</li>
  <li><a href="https://www.owasp.org/index.php/Top_10_2013-A1-Injection">OWASP Top 10 2013 Category A1</a> - Injection</li>
</ul>
